The Industrial Internet of Things (IIoT) generates high-dimensional traffic data that challenge conventional intrusion detection systems. This paper presents a comparative study of ten manifold learning methods evaluated across five heterogeneous IIoT cybersecurity datasets, including trust-based routing, malware traffic, edge-device telemetry, large-scale network flows, and private Spanish Power Grid data. Performance was assessed using bootstrap-aggregated metrics covering neighborhood preservation, global fidelity, and supervised cluster separation. Results showed that nonlinear methods dominated local structure preservation: t-distributed Stochastic Neighbor Embedding (t-SNE) and Uniform Manifold Approximation and Projection (UMAP) consistently achieved the highest Trustworthiness, reaching 0.999 (on Spanish Power Grid data) and 0.998 (on WUSTL-IIoT-2021 dataset). In contrast, multidimensional scaling (MDS) minimized Stress (as low as 0.096 in WUSTL-IIoT-2021), confirming its superiority in global geometry preservation. Principal Component Analysis (PCA) delivered competitive supervised separation, obtaining the best Davies–Bouldin index (0.750) and Silhouette score (0.851) on WUSTL-IIoT-2021, outperforming nonlinear methods in these metrics. Malware traffic in CIMD-2024 proved most challenging, where even the best embeddings yielded Davies–Bouldin scores above 20, highlighting the complexity of polymorphic attack families. Overall, findings demonstrate that no single method is universally optimal: t-SNE and UMAP maximize local fidelity, MDS ensures global consistency, and PCA remained highly competitive for anomaly separation with low computational cost. These results support the design of IIoT security pipelines that strategically combine complementary dimensionality reduction methods for effective and scalable intrusion detection.
